Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
9,764 detections
Filters
Last updated
All Time
Detection languages
3,724
2,041
1,335
1,055
969
Contributors
2,963
2,050
1,372
1,231
485
Categories
5,723
3,080
1,138
901
659
Platforms
9,650
659
432
53
30
Products / Services
10,704
9,764
6,706
4,421
3,752
MITRE Techniques
3,828
3,377
1,982
1,618
1,042
CVEs
18
14
12
12
11
Detects the creation of threads where the entry point or call stack is associated with 'kernel32.dll' but originates from memory regions that are unbacked by a file on disk (i.e., 'unbacked', 'unknown') or have a null return address. This pattern is highly indicative of reflective code injection or manual shellcode execution, where an adversary attempts to execute code within a legitimate Windows process without a corresponding file-backed image.
Detects instances where the Google Chrome browser process interacts with files or registry keys associated with audio and video capture devices, such as cameras and microphones. This may indicate unauthorized use of media peripherals by the browser process.
This rule detects remote thread creation where the start function address is identified as 'AnimateWindow'. This behavior is associated with the SparroWocky technique, which uses thread execution hijacking by pointing the thread start address to legitimate UI-related Windows APIs to mask the actual malicious entry point, thereby evading traditional detection mechanisms that monitor for suspicious thread start addresses.
This rule monitors for indicators of code execution anomalies commonly associated with process injection, ROP (Return-Oriented Programming) chains, or memory manipulation. It specifically looks for spoofed call stacks, return address validation failures, suspicious API usage in common thread initialization routines, and ROP gadgets within critical modules like kernel32.dll.
Detects ClickFix-style activity where a web browser or common application launcher spawns a terminal or PowerShell process to execute obfuscated, copied, or piped commands. This behavior often indicates a social engineering attack where a user is tricked into manually executing a malicious command script.
Detects the creation of a registry value named 'SnapCart' within the Windows Run keys. Adversaries use Run keys to ensure that malicious programs execute automatically upon user login or system startup, establishing persistence on the compromised host.
This rule detects high-frequency, sub-second screen capture activity typically associated with malwares utilizing screen scraping to exfiltrate changed screen regions. It specifically monitors API calls related to graphical interface manipulation (BitBlt, GDI) and screen capture events, triggering when the frequency of these calls reaches a consistent, rapid interval.
Detects the execution of batch files named 'db.bat' or 'adb.bat' from the Windows User Temp directory using cmd.exe. This activity is a known indicator of the OpnKey ransomware, which utilizes these scripts to facilitate its operations.
Detects uncommon or suspicious child processes spawning from a WSL process. This could indicate an attempt to evade parent/child relationship detections or persistence attempts via cron using WSL.
Detects the use of the Windows schtasks utility to delete a scheduled task named 'Windows Update'. This pattern is associated with OpnKey ransomware, which attempts to remove legitimate or potentially competing tasks to maintain persistence or avoid detection.
Detects uncommon or suspicious child processes spawning from a WSL process. This could indicate an attempt to evade parent/child relationship detections or persistence attempts via cron using WSL.
Detects the deletion of a file named 'Config.ini', a behavior associated with the OpnKey ransomware for cleaning up configuration artifacts after its execution cycle.
Detects web server processes (e.g., w3wp.exe, nginx.exe, tomcat.exe) spawning command-line interpreters or utilities that could indicate remote code execution, web shell activity, or post-exploitation discovery/download attempts.
Detects web server processes (e.g., w3wp.exe, nginx.exe, tomcat.exe) spawning command-line interpreters or utilities that could indicate remote code execution, web shell activity, or post-exploitation discovery/download attempts.
Detects the use of database or archiving command-line utilities to export data related to RADIUS services. The rule filters out known backup service accounts and authorized backup processes, flagging activity that occurs outside of standard business hours or is performed by accounts not explicitly designated for administrative or database maintenance tasks.
Detects the deletion of the registry key responsible for Chrome extension integrity verification (PreferenceMACs). Deleting this key allows an adversary to tamper with installed Chrome extensions without triggering security warnings. This activity has been observed in the Rapuncel campaign.
Detects the loading and service creation of the CcProtect/Alinubx kernel driver, a known technique for Bring Your Own Vulnerable Driver (BYOVD) attacks. The rule identifies suspicious characteristics such as file name mismatches, unauthorized product/company signatures, and the creation of services associated with this malicious driver family (e.g., NvFsFilter) to facilitate EDR/AV termination or privilege escalation.
Detects the deletion of the registry key responsible for Chrome extension integrity verification (PreferenceMACs). Deleting this key allows an adversary to tamper with installed Chrome extensions without triggering security warnings. This activity has been observed in the Rapuncel campaign.
Detects the execution of ServiceModelReg.exe following parent process activity involving vsdbg.dll/vsdbg.exe, coupled with cross-process access indicators consistent with COM Elevation Moniker UAC bypass and potential process hollowing. This pattern is associated with the PUROSANGUE loader chain used to execute malicious code within a high-integrity process context.
This rule detects the potential bypassing of Protected Process Light (PPL) in Windows, characterized by kernel-mode driver activity (such as ObOpenObjectByPointer) correlated with the mass termination of security-related processes (e.g., Defender, CrowdStrike, SentinelOne). The correlation between driver-level object handle manipulation and the termination of protected security binaries is a strong indicator of an adversary attempting to disable EDR/AV protections via kernel exploitation or driver abuse.
Detects the installation and loading of a suspicious driver named 'NvFsFilter' (nvfsflt64.sys), accompanied by registry persistence and suspicious process termination events. This pattern is characteristic of a 'kill-loop' persistence mechanism where malicious drivers or services repeatedly terminate security agents (AV/EDR) to maintain a persistent foothold on the endpoint.
Page 98 of 465